{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in GCDWebServer before 3.5.3. The method moveItem in the GCDWebUploader class checks the FileExtension of newAbsolutePath but not oldAbsolutePath. By leveraging this vulnerability, an adversary can make an inaccessible file be available (the credential of the app, for instance)."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-08-10T18:34:17", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/swisspol/GCDWebServer/issues/433"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/swisspol/GCDWebServer/commit/02738433bf2e1b820ef48f04edd15df304081802"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/swisspol/GCDWebServer/compare/3.5.2...3.5.3"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2019-14924", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An issue was discovered in GCDWebServer before 3.5.3. The method moveItem in the GCDWebUploader class checks the FileExtension of newAbsolutePath but not oldAbsolutePath. By leveraging this vulnerability, an adversary can make an inaccessible file be available (the credential of the app, for instance)."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://github.com/swisspol/GCDWebServer/issues/433", "refsource": "MISC", "url": "https://github.com/swisspol/GCDWebServer/issues/433"}, {"name": "https://github.com/swisspol/GCDWebServer/commit/02738433bf2e1b820ef48f04edd15df304081802", "refsource": "MISC", "url": "https://github.com/swisspol/GCDWebServer/commit/02738433bf2e1b820ef48f04edd15df304081802"}, {"name": "https://github.com/swisspol/GCDWebServer/compare/3.5.2...3.5.3", "refsource": "MISC", "url": "https://github.com/swisspol/GCDWebServer/compare/3.5.2...3.5.3"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T00:34:51.695Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/swisspol/GCDWebServer/issues/433"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/swisspol/GCDWebServer/commit/02738433bf2e1b820ef48f04edd15df304081802"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/swisspol/GCDWebServer/compare/3.5.2...3.5.3"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2019-14924", "datePublished": "2019-08-10T18:34:17", "dateReserved": "2019-08-10T00:00:00", "dateUpdated": "2024-08-05T00:34:51.695Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gcdwebserver_project:gcdwebserver:*:*:*:*:*:*:*:*", "matchCriteriaId": "4F2F760D-95AB-48E1-9F40-143CB1CCB104", "versionEndExcluding": "3.5.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in GCDWebServer before 3.5.3. The method moveItem in the GCDWebUploader class checks the FileExtension of newAbsolutePath but not oldAbsolutePath. By leveraging this vulnerability, an adversary can make an inaccessible file be available (the credential of the app, for instance)."}, {"lang": "es", "value": "Se detect\u00f3 un problema en GCDWebServer anterior a versi\u00f3n 3.5.3. El m\u00e9todo moveItem en la clase GCDWebUploader comprueba la FileExtension de newAbsolutePath pero no de oldAbsolutePath. Mediante el aprovechamiento de esta vulnerabilidad, un adversario puede hacer que un archivo inaccesible est\u00e9 disponible (la credencial de la aplicaci\u00f3n, por ejemplo)."}], "id": "CVE-2019-14924", "lastModified": "2024-11-21T04:27:41.560", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "[email protected]", "type": "Primary"}]}, "published": "2019-08-10T19:15:10.920", "references": [{"source": "[email protected]", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/swisspol/GCDWebServer/commit/02738433bf2e1b820ef48f04edd15df304081802"}, {"source": "[email protected]", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/swisspol/GCDWebServer/compare/3.5.2...3.5.3"}, {"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "https://github.com/swisspol/GCDWebServer/issues/433"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/swisspol/GCDWebServer/commit/02738433bf2e1b820ef48f04edd15df304081802"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/swisspol/GCDWebServer/compare/3.5.2...3.5.3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/swisspol/GCDWebServer/issues/433"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "[email protected]", "type": "Primary"}]}

{}